diff --git a/manifests/site.pp b/manifests/site.pp
index 7678711be9..a4b7410304 100644
--- a/manifests/site.pp
+++ b/manifests/site.pp
@@ -1179,6 +1179,8 @@ node 'controller00.hpuswest.ic.openstack.org' {
     br_name                          => 'br-vlan25',
     controller_management_address    => '10.10.16.146',
     controller_public_address        => $::fqdn,
+    openstackci_password             => hiera('openstackci_infracloud_password'),
+    openstackjenkins_password        => hiera('openstackjenkins_infracloud_password'),
   }
 }
 
diff --git a/modules/openstack_project/manifests/infracloud/controller.pp b/modules/openstack_project/manifests/infracloud/controller.pp
index 238b96a488..ac04793611 100644
--- a/modules/openstack_project/manifests/infracloud/controller.pp
+++ b/modules/openstack_project/manifests/infracloud/controller.pp
@@ -17,6 +17,10 @@ class openstack_project::infracloud::controller (
   $br_name,
   $controller_management_address,
   $controller_public_address = $::fqdn,
+  $openstackci_password,
+  $openstackci_email = 'infra-root@openstack.org',
+  $openstackjenkins_password,
+  $openstackjenkins_email = 'infra-root@openstack.org',
 ) {
   class { '::infracloud::controller':
     keystone_rabbit_password         => $keystone_rabbit_password,
@@ -57,4 +61,22 @@ class openstack_project::infracloud::controller (
     domain      => 'infra',
     require     => Keystone_domain['infra'],
   }
+
+  keystone_user { 'openstackci':
+    ensure   => present,
+    enabled  => true,
+    domain   => 'infra',
+    email    => $openstackci_email,
+    password => $openstackci_password,
+    require  => Keystone_tenant['openstackci'],
+  }
+
+  keystone_user { 'openstackjenkins':
+    ensure   => present,
+    enabled  => true,
+    domain   => 'infra',
+    email    => $openstackjenkins_email,
+    password => $openstackjenkins_password,
+    require  => Keystone_tenant['openstackjenkins'],
+  }
 }